4 ms·

This is the one downside of Let's Encrypt. They made running https scam sites cheap and easy. I still think having https everywhere is worth the trade off, but

This is the one downside of Let's Encrypt. They made running https scam sites cheap and easy. I still think having https everywhere is worth the trade off, but the downside should be acknowledged. I wish there were an EV certificate like alternative for sites where actual money is involved (banking, hotels, etc) which cost a decent amount of money, so that at least the cost of running these scams would go up. For example, airbnb paying $1000 for one of these certificates would be a rounding error to them, but it would stop a lot of scam sites. EDIT: Right now the issue is the phishing protection is reactive in that we try to flag bad sites after the fact. I wish there was someway to make it proactive so that good sites could be attested to.

outworlder 7y ago
Hey, at least then your banking information will be known by the 'intended' scammer, not others that may be listening in the wire :)
endorphone 7y ago
That isn't a downside of L.E. though because HTTPS by itself was never meant to imply trust in the site, and any notions to that effect should rightly be dispelled. Sounds more like a benefit of LetsEncrypt if it brought more awareness to this. And FWIW the EV cert that sites like AirBNB buy cost in the range of $500. The cost isn't what makes it prohibitive, though, but instead it's the corporate and personal identity that they (should) do as a part of the process.
- nkozyra 7y ago
  > but instead it's the corporate and personal identity that they (should) do as a part of the process. And often that isn't nearly as intensive as you might think.
  - tialaramex 7y ago
    It doesn't even matter. Tax havens like the United States of America or the United Kingdom go out of their way to make it easy for foreigners to create "corporations" with no local footprint, no ties back to anything and no practical way to investigate. If you have $1000 and don't live there you can set up a bona fide US Corporation today and get an EV cert issued for it, within 24 hours. So long as you pick a unique name in the place where you register (any of 50 different US states) they don't need and won't ask for any further information - the paperwork will show up as "American" even if you can't point at the US on a map and have never even visited in your whole life. Congratulations, you are entitled to an EV certificate for, let's say, Okland Best Property Rentals Inc. a US company that older browsers show a proper American flag for and looks 100% legit but in fact proves nothing except that you filled out a web form and had a few hundred dollars. If somebody tries to "send in the cops" to "Okland Best Property Rentals" expecting it's some crook who actually lives in California they'll be fighting a multi-billion dollar state-sponsored entity whose purpose is to help (non-US) crooks hide money, the agencies will stall and eventually, after a long and expensive fight, give up a PO box address in Abuja, Nigeria or something. There the trail ends. Bye.
walrus01 7y ago
The fact that domain verified TLS/SSL is possible for free now, compared to a token payment of $7, doesn't change the fact that domain-verified SSL has never been, and should never be a verification of legitimate corporate identity. https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html

outworlder 7y ago

Hey, at least then your banking information will be known by the 'intended' scammer, not others that may be listening in the wire :)

endorphone 7y ago

That isn't a downside of L.E. though because HTTPS by itself was never meant to imply trust in the site, and any notions to that effect should rightly be dispelled. Sounds more like a benefit of LetsEncrypt if it brought more awareness to this. And FWIW the EV cert that sites like AirBNB buy cost in the range of $500. The cost isn't what makes it prohibitive, though, but instead it's the corporate and personal identity that they (should) do as a part of the process.

nkozyra 7y ago
> but instead it's the corporate and personal identity that they (should) do as a part of the process. And often that isn't nearly as intensive as you might think.
- tialaramex 7y ago
  It doesn't even matter. Tax havens like the United States of America or the United Kingdom go out of their way to make it easy for foreigners to create "corporations" with no local footprint, no ties back to anything and no practical way to investigate. If you have $1000 and don't live there you can set up a bona fide US Corporation today and get an EV cert issued for it, within 24 hours. So long as you pick a unique name in the place where you register (any of 50 different US states) they don't need and won't ask for any further information - the paperwork will show up as "American" even if you can't point at the US on a map and have never even visited in your whole life. Congratulations, you are entitled to an EV certificate for, let's say, Okland Best Property Rentals Inc. a US company that older browsers show a proper American flag for and looks 100% legit but in fact proves nothing except that you filled out a web form and had a few hundred dollars. If somebody tries to "send in the cops" to "Okland Best Property Rentals" expecting it's some crook who actually lives in California they'll be fighting a multi-billion dollar state-sponsored entity whose purpose is to help (non-US) crooks hide money, the agencies will stall and eventually, after a long and expensive fight, give up a PO box address in Abuja, Nigeria or something. There the trail ends. Bye.

walrus01 7y ago

The fact that domain verified TLS/SSL is possible for free now, compared to a token payment of $7, doesn't change the fact that domain-verified SSL has never been, and should never be a verification of legitimate corporate identity. https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html